Remote syslog
-
Is remote syslog possible with TNSR? I couldn't really find any detail in the guides to suggest it's possible but am I mising something has anyone else managed to get this working.
We want to be able to monitor events like login events, BGP status changes etc.
-
TNSR itself doesn't have any configuration options to set that up but you can manually configure it at the OS level however you like.
The exact procedures may vary based on what version you are running since the underlying OS may change (e.g. CentOS 7, CentOS 8, or Ubuntu on the upcoming version of TNSR), but there are tutorials around the web for all of those.
-
@jimp Thanks, I have since found that out.
Heads up for anyone else trying to get this working on CentOS, the information you are looking for to get this working is to specify the NetworkNamespace="dataplane" in your rsyslog.conf configuration. This would have been a useful tip as it goes off the typical, basic, default config in rsyslog and specific for the TNSR config.
example config for my rsyslog.conf that work for me in CentOS 8:-
action(type="omfwd"
queue.filename="tnsr_syslog"
queue.maxdiskspace="1g"
queue.saveonshutdown="on"
queue.type="LinkedList"
action.resumeRetryCount="-1"
Target="example.com" Port="514" Protocol="udp" NetworkNamespace="dataplane")
